CVE-2026-83801

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

EUVD-2026-84814

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801

Nautobot is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.4.37 and 3.1.8 . The root cause is the lack of adequate neutralization when user-controlled values—specifically Relationship descriptions (requiring extras.add_relationship / extras.change_relationship) or Module F...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

CVE-2026-83801 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

Security update for cups

This update for cups fixes the following issue: CVE-2026-87875,GHSA-559w-7676-3xrq: heap out-of-bounds read in cupsUTF32ToUTF8 due to missing source-length bound can be reached via the SNMP supply-description parsing bsc1279945. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:4281-1 Security update for cups

This update for cups fixes the following issue: - CVE-2026-87875,GHSA-559w-7676-3xrq: heap out-of-bounds read in cupsUTF32ToUTF8 due to missing source-length bound can be reached via the SNMP supply-description parsing bsc1279945...

CVE-2026-93952

creationtimestamp| type| source ---|---|--- 2026-09-22 07:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw3qipnnvk2t 2026-09-22 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117313871866403815 2026-09-22 09:00:28+00:00| seen|...

CVE-2026-83801: Improper Neutralization of Input During Web Page Generation

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.addrelationship or extras.changerelationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.addmodulefamily or dcim.changemodulefamily...

PT-2026-97022

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.37 Nautobot versions prior to 3.1.8 Description Users with specific permissions can store HTML or JavaScript in a Relationship description or a Module Family name. Nautobot assigns these values to form field help...

CVE-2026-47321

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

SUSE-SU-2026:23877-1 Security update for cups

This update for cups fixes the following issue: - CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8 due to missing source-length bound can be reached via the SNMP supply-description parsing bsc1279945...

SUSE-SU-2026:23925-1 Security update for cups

This update for cups fixes the following issue: - CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8 due to missing source-length bound can be reached via the SNMP supply-description parsing bsc1279945...

OPENSUSE-SU-2026:21893-1 Security update for cups

This update for cups fixes the following issue: - CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8 due to missing source-length bound can be reached via the SNMP supply-description parsing bsc1279945...

CVE-2026-84073

creationtimestamp| type| source ---|---|--- 2026-09-18 22:09:54+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvt6ojf2ec2p 2026-09-18 23:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvtd5uqx3k2w 2026-09-19 23:01:32+00:00| seen|...

DEBIAN-CVE-2026-61720

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

DEBIAN-CVE-2026-61722

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS...

DEBIAN-CVE-2026-58264

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

DEBIAN-CVE-2026-55556

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...